﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.ServiceModel.Dispatcher;

namespace Infrastructure.Aspect.Validation.Wcf
{
    public   class SqlInjectParameterInspector : IParameterInspector
    {
        public void AfterCall(string operationName, object[] outputs, object returnValue, object correlationState)
        {
            
        }
        public object BeforeCall(string operationName, object[] inputs)
        {
            var bad = new string[]{ ";", "UNION", "union", "DROP", "drop", "table", "TABLE", "SET", "set", "UPDATE", "update", "SELECT", "select", "-", "--"};  

            foreach (var item in inputs)
            {                
                var target  =  item as string;
                if (target != null && bad.Where(c=>target.Contains(c)).FirstOrDefault() != null)
                {
                    throw new System.ServiceModel.FaultException("Sql Injection Warning");
                }                
            }
            return null;  
        }
    }
}
